Siemens Software Center flaw exploited in ClickFix malware attacks

SecurityWeek reports that Siemens confirmed attackers exploited a Siemens Software Center flaw and linked the attacks to the Romulus ClickFix operation. Attackers paired a legitimate, signed copy of the program with malicious DLLs that it loaded at startup. Siemens said its software was not tampered with and the malicious package did not come through its distribution channels. Version 4.0.9.8 fixes the flaw; installed copies receive the update when next launched.